5

I am looking for a way to check when a specific folder and also a specific file were created. Is it possible?

My system uses the ext3 file system.

Thanks a lot!

4
  • 1
    A specific folder or file? Add a bit more information and an example, that will score you better answers ;) Nov 11, 2011 at 9:33
  • do you mean "at what date/time the file was created" or do you meant something in the lines of monitoring whether a certain file is being created?
    – xubuntix
    Nov 11, 2011 at 9:34
  • Thanks Brunoperceira81, If possible, I would like to know both the creation time of some specific folder and specific file. :-)
    – Anand
    Nov 11, 2011 at 9:35
  • 1
    Thanks Xubuntix. I mean that "at what date/time the file was created" . Thanks a lot! :-)
    – Anand
    Nov 11, 2011 at 9:36

4 Answers 4

9

Most Unix-like operating systems don't store the creation time of file or directories. You can get their modification time, last access time, and inode change time via the ls and stat commands.

But, there are some third party tools as we can see in other answers. And, FreeBSD seems to have that capability. See @Graham Perrin's comment here which goes to that answer.

5
  • I am using the latest Ubuntu 11.10. The install is by default. I didn't change anything. Then does that mean that my file system should not store the creation time? Thank you very much! :-)
    – Anand
    Nov 11, 2011 at 9:38
  • As I said there is not a literal creation time info. It changes file by file but if modification time is not being changed since installtion, that could be creation time of course. Again, this question and its answer depends on spesific cases. Nov 11, 2011 at 9:44
  • 1
    this really depends on the filesystem. Ubuntus default is ext4, which supports the creation time. See my answer.
    – xubuntix
    Nov 11, 2011 at 9:56
  • By the way, files and the directory that contains the files have been changed constantly since being created.
    – Anand
    Nov 11, 2011 at 12:31
  • "Unix-like operating systems don't store the creation time of file or directories…" is too broad a statement. Consider unix.stackexchange.com/questions/20460/… Mar 26, 2017 at 0:58
5

Assuming that you are using ext4, you can see when a file was created. The ext4 file system stores this as crtime.

You can get this information with the debugfs command.

Here is a script that you can run with superuser privileges to print the crtime of a file. (Note that it requires ruby and has a bug in the first line: #!/usr/bin/env ruby)

5
  • Thanks xubuntix, I installed ruby and the code. It doesn't work. then I found that my file system is ext3 unfortunately.:-(
    – Anand
    Nov 11, 2011 at 12:30
  • @xubuntix , this is a good info and I understand that I am a bit behind the developments :) Is whole script needed for that? With debugfs can't we get crtime? ie: debugfs -R 'stat ' file_name Nov 11, 2011 at 13:09
  • yes, debugfs alone will get you the crtime as well, but at least when I tried it, additional steps were required. And just to be clear: i did not write script, but i thought it was handy...
    – xubuntix
    Nov 11, 2011 at 18:50
  • @xubuntix Thanks for pointing out the Ruby script, but even though I have an ext4 file system, it exits with an error message: crtime.ruby:47:in <main>': undefined method first' for "/dev/sda5":String (NoMethodError). Dec 2, 2014 at 12:20
  • I have an ext4 file system and my version of stat is recent enough to know about the creation time, but it shows a Birth: - line for every file I throw at it ... :( Dec 2, 2014 at 12:21
1

The brute force 'old school' way for ext3 is the "Tripwire" method (I named it from the insidious Tripwire product): build a list of files, then do it again, run diff. The more often you build your list and diff it, more close in time you will know when directories were both created AND deleted.

The two ways to build such a list is use: ls or to use lsof. You only need to save the diffs. If you know the user or the specific parent directory is not too large, then you can run it every second or more often (since sleep takes decimals) in a loop.

0

You can use a third party tool to do the job : I think of OSSEC, which is able to monitor directory content and file modification.

1
  • 1
    How does that tell you the point in time when an already existing file or directory was created?
    – user
    Nov 11, 2011 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .